Yes Paul I did.
After running the NAS set up I ran the kinit test with the domanin name
kinit -k <domain_name>
After running this I receive back the $ prompt which the documentation
indicates it has worked successfully
I have set up the IBM Tivoli Directory Server (LDAP) - there is no option
to verify but this is just defining the password
and yes the server is started.
I created the EIM domain on the local server and verified the connection -
Successfully
I then created an EIM Identifier with source and target associations which
creates successfully.
But I can't see anywhere to test the Source and Target entries - where are
you seeing this ???
I then am connecting to a VPN and logging on the a server that I have
installed Java and iACS.
I am logging into the domain that was configured in NAS
I create a system connection specifying kerberos authentication.
I then try and start a 5250 session and receive the error
MSGKRB001 - Kerberos error for system <ip-address> (Failure unspecified at
GSS-API level (Mechanism
level:80090303=InitiateSecurityContext() len=16384 ctx=00000000
SEC_E_TARGET_UNKNOWN))
I have reviewed all this set up and re verified connections and all seems
fine.
Any suggestions ?
Thanks
Don
From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'Don Brown'" <DBrown@xxxxxxxxxx>
Cc: "'Midrange Systems Technical Discussion'"
<midrange-l@xxxxxxxxxxxxxxxxxx>, "MIDRANGE-L"
<midrange-l-bounces@xxxxxxxxxxxxxxxxxx>
Date: 21/07/2021 10:20 AM
Subject: RE: SSO Setup Issue - Error
Don,
Using Nav for I, in your EIM domain, did you create an identifier, source
association, and target association.
There is also an option to test this.
Paul
From: Don Brown <DBrown@xxxxxxxxxx>
Sent: Tuesday, July 20, 2021 7:14 PM
To: Steinmetz, Paul <PSteinmetz@xxxxxxxxxx>
Cc: 'Midrange Systems Technical Discussion'
<midrange-l@xxxxxxxxxxxxxxxxxx>; MIDRANGE-L
<midrange-l-bounces@xxxxxxxxxxxxxxxxxx>
Subject: RE: SSO Setup Issue - Error
Thanks Paul,
Yes the kinit does succeed
As far as folowing the set up document goes everything that has a way to
verify has passed / succeeded.
It is the final step where I set the iACS connection to kerberos and try
and connect when I get the error.
Any suggestions on how to identify the error ?
Thanks
Don
From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'Midrange Systems Technical Discussion'" <
midrange-l@xxxxxxxxxxxxxxxxxx>
Cc: "Don Brown" <DBrown@xxxxxxxxxx>, "MIDRANGE-L" <
midrange-l-bounces@xxxxxxxxxxxxxxxxxx>
Date: 20/07/2021 10:47 PM
Subject: RE: SSO Setup Issue - Error
Using qsh, you can see all your principals in your keytab file.
kinit -k
Then you can verify your config by running the below for one of your
principals.
The domain is case sensitive.
Should return only a $ if working properly.
kinit -k krbsvr400/FQCN@domain
$
Paul
-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Don
Brown via MIDRANGE-L
Sent: Tuesday, July 20, 2021 2:21 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Cc: Don Brown <DBrown@xxxxxxxxxx>; MIDRANGE-L <
midrange-l-bounces@xxxxxxxxxxxxxxxxxx>
Subject: Re: SSO Setup Issue - Error
________________________________
CAUTION: This email originated from outside of the PENCOR network. Do not
click on any links or open attachments unless the sender is known, and the
content is verified as safe.
________________________________
I did find in the service logs the following informaiton
# WARNING# 2021/07/20 14:02:04.668 AEST# Thread: 67#
com.ibm.iaccess.base.AcsSystemConfig.getAuthKerberos
(AcsSystemConfig.java:1983) [/4.dat]
SNAP **** Exception!
SNAP class com.ibm.as400.access.AS400SecurityException: Kerberos
service ticket could not be retrieved.
SNAP Caused by: class org.ietf.jgss.GSSException: Failure unspecified
at GSS-API level (Mechanism level: 80090303=InitializeSecurityContext()
len=16384 ctx=00000000 SEC_E_TARGET_UNKNOWN) SNAP
Which indicates it could not obtain a service ticket but I can find
anything meaningful as to why .
Don
From: "Don Brown via MIDRANGE-L" <midrange-l@xxxxxxxxxxxxxxxxxx>
To: midrange-l@xxxxxxxxxxxxxxxxxx
Cc: "Don Brown" <DBrown@xxxxxxxxxx>
Date: 20/07/2021 04:02 PM
Subject: SSO Setup Issue - Error
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxxxxxxxx>
I am trying to set up SSO on a V7R3 IBMi
The box does not have support - it is only used for testing and is being
decommissioned
This is just a proof of concept / test for SSO
I have followed the document
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ibm.com_support_pages_how-2Dconfigure-2Deim-2Dand-2Dnas-2Dusing-2Dibm-2Dnavigator-2Di&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=2dhvygJJXJbcJauI0JqOMWt_8w_V5WKIPhHT4_kXwdU&e=
All the verification has succeeded but when I try to log on using kerberos
authentication I get the error;
MSGKRB001 - Kerberos error for system <ip-address> (Failure unspecified at
GSS-API level (Mechanism
level:80090303=InitiateSecurityContext() len=16384 ctx=00000000
SEC_E_TARGET_UNKNOWN))
Can anyone point me in the right direction to understand / resolve this
issue.
Thank you in advance.
Don
--
This email has been scanned for computer viruses. Although MSD has taken
reasonable precautions to ensure no viruses are present in this email, MSD
cannot accept responsibility for any loss or damage arising from the use
of this email or attachments..
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit:
https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.midrange.com_mailman_listinfo_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=augqYrCJFn0diFdjH_NgIEs7eDxLkAznf3i27bPFj-o&e=
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://urldefense.proofpoint.com/v2/url?u=https-3A__archive.midrange.com_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=mfDCf8WXAR5eKTnJ9gLW7tkJMv3WOZ-izpx_ZlaY3Vg&e=
.
Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.
Help support
https://urldefense.proofpoint.com/v2/url?u=http-3A__midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=hTU-0LdmeG_7MrqM6shHg-VymfqINeqAUZeLKBO9T3Y&e=
by shopping at
https://urldefense.proofpoint.com/v2/url?u=http-3A__amazon.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=vKp3qkPX_q53UI9DdpZ25gPL7UmftbfN4K7Yj20kgH8&e=
with our affiliate
link:
https://urldefense.proofpoint.com/v2/url?u=https-3A__amazon.midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=Hola-a7jyK4FcIBvirBBBQXO5JU8XFptVjo2mi6VvXI&e=
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit:
https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.midrange.com_mailman_listinfo_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=augqYrCJFn0diFdjH_NgIEs7eDxLkAznf3i27bPFj-o&e=
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://urldefense.proofpoint.com/v2/url?u=https-3A__archive.midrange.com_midrange-2Dl&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=mfDCf8WXAR5eKTnJ9gLW7tkJMv3WOZ-izpx_ZlaY3Vg&e=
.
Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.
Help support
https://urldefense.proofpoint.com/v2/url?u=http-3A__midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=hTU-0LdmeG_7MrqM6shHg-VymfqINeqAUZeLKBO9T3Y&e=
by shopping at
https://urldefense.proofpoint.com/v2/url?u=http-3A__amazon.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=vKp3qkPX_q53UI9DdpZ25gPL7UmftbfN4K7Yj20kgH8&e=
with our affiliate link:
https://urldefense.proofpoint.com/v2/url?u=https-3A__amazon.midrange.com&d=DwIFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=x3rBwxMTlO3UcnVchBJYlkqPD8BpO91HbuZYQ_ZepUs&m=Ab2mGfNvVyI4ehCNV5JKQWPeSfKRBgCvGNAQ4IV6faU&s=Hola-a7jyK4FcIBvirBBBQXO5JU8XFptVjo2mi6VvXI&e=
midrange.com
